Messages in this thread | | | From | KOSAKI Motohiro <> | Date | Thu, 22 Dec 2011 11:58:13 -0500 | Subject | Re: [PATCH] mm: mmap system call does not return EOVERFLOW |
| |
> To fix this bug, it is necessary to compare "off" plus "len" > with "off" by units of "off_t". The patch is here: > > Signed-off-by: Naotaka Hamaguchi <n.hamaguchi@jp.fujitsu.com> > --- > mm/mmap.c | 3 ++- > 1 files changed, 2 insertions(+), 1 deletions(-) > > diff --git a/mm/mmap.c b/mm/mmap.c > index eae90af..e74e736 100644 > --- a/mm/mmap.c > +++ b/mm/mmap.c > @@ -948,6 +948,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr, > vm_flags_t vm_flags; > int error; > unsigned long reqprot = prot; > + off_t off = pgoff << PAGE_SHIFT; > > /* > * Does the application expect PROT_READ to imply PROT_EXEC? > @@ -971,7 +972,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr, > return -ENOMEM; > > /* offset overflow? */ > - if ((pgoff + (len >> PAGE_SHIFT)) < pgoff) > + if ((off + len) < off) > return -EOVERFLOW;
Hmm... pgoff doesn't make actual overflow. do_mmap_pgoff() can calculate big value. We have no reason to make artificial limit. Why don't you meke a overflow check in sys_mmap()? -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |